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ABSTRACT 


Six false alarms occurred at NORAD in 1978, 1979, and 
1980. These false alarms subsequently regenerated interest 
in launch policies and the increased possibility of acci- 
dental nuclear war, which motivated this investigation. We 
construct a new model to address several questions: What is 
the sequence of events and reasonable timing between events 
in the missile warning system? How much time do decision 
makers have to respond to a threat? What effects do United 
States launch policies have on decision-making time? How 
likely is accidental nuclear war? 

The results show that accidental nuclear war is not very 
probable with launch-under-attack, but significantly more 
likely if the United States adopts a launch-on-warning 
policy. The final decision and responsibility to use these 
policies, once they are implemented, rests entirely with the 
President of the United States. 
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I. INTRODUCTION 

Early warning information provides decision makers with 
a description of enemy forces as they prepare for, or actu- 
ally initiate, an attack. Given early warning, decision 
makers in the military and the government, including the 
President, can more adequately decide on a response during a 
crisis. When policy makers discuss changes to the regula- 
tions pertaining to the early warning system, they need to 
realize the implications of such policy changes on the 
System. This thesis presents the current early warning 
System, discusses proposed launch policies, and explores the 
possible results from implementing these policies. 

Warning information is essential for the survival of the 
Dany parts of our arsenal and its related control systems. 
For example, the bomber force depends on timely early 
warning so that it may scramble from ground alert to 
airborne stations where it is less vulnerable to nuclear 
attack. But the use of warning to save the bomber force, or 
any other weapon system, addresses only a narrow aspect of 
warning. The most important aspect of early warning is to 
give advance warning of an enemy's attack, so that the deci- 
Sion maker has a chance to give the appropriate response to 
an attack. Both the United States and the Soviet Union 
continue to build systems of extreme complexity for early 
warning. Intelligence systems have merged with warning 
systems, yielding one overall system which is integrated 
vertically with military forces. 

Future strategic technology is likely to make nuclear 
war more thinkable, especially as nuclear weapons spread to 
unstable countries less inclined to respect the nuclear 


threshold. The problem of nuclear weapons proliferation 


concerns a large number of governments and is intimately 
related to the basic energy needs of both the developed and 
developing nations. It has fast become an issue of high 
politics on a global scale. Further, many of the developing 
nations claim that the United States, in the name of non- 
proliferation, seeks to implement policies that are highly 
discriminatory to the non-nuclear states and are designed to 
Maintain American political, military, and economic power at 
the expense of the poorer nations. Hence, no global 
consensus exists on either the threat posed by nuclear 
proliferation or the steps that should be taken to deal with 
it. Instead, this issue inflames domestic debate in many 
nations, strains alliance relationships, sharpens the 
confrontation between East and West, and complicates 
concepts of national and international security. Within 
this framework of the threat of general nuclear war exists a 
concern for accidental or unintentional nuclear war. 

We are rapidly approaching a decisive point of demarca- 
tion in the history of the nuclear arms race; namely, the 
first strike counter-force threshold. This means both the 
arsenals of the United States and the USSR will be highly 
vulnerable to surprise attack. As a result, efforts to 
control the momentum and direction of the nuclear arms race 
are increasingly complicated and the possibility for acci- 
dental war substantially grows. 

Senator Mark Hatfield describes the threat as our 
pecception of a Soviet weapons build-up, a nuclear blackmail 
[Ref. 1: p. 3]. He describes the Soviet Intercontinental 
Ballistic Missile (ICBM) threat as impressive, yet destabi- 
lizing, because we can no longer rely on technology to save 
us from war. Following a decade of massive arms spending, 
the Soviet Union comes to the current round of lisarmament 
talks with a suffering economy. Still, Hatfield claims, the 
United States strategists point to the Soviet's apparent 
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Superiority by counting the number of Soviet warheads and 
comparing this to the number of our warheads. In this 
paper, our real concern is not with the numbers question, 
but with how accurately and quickly we can discern i£ we are 


under attack and what should be the appropriate response. 
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II. BACKGROUND 


A. WHY STUDY THE PROBABILITY OF ACCIDENTAL NOCLEAR SAR? 


1. The Historical Perspective 


From our everyday newspapers, we read about the 
increasing tension and anxiety surrounding the strategic 
forces of the United States. Since the close of World War 
TI, the Western Alliance has feared attacks from the Soviet 
Union in Europe and in other United States defended territo- 
ries, as well as the subjugation of its power and ideals to 
the Communist philosophy. 0£ course, the Soviet Union fears 
the same from the West. In between the super powers lie the 
smaller nations, each wanting to expand their own influence 
and power in the world in ways Similar to the super powers, 
especially by building or buying nuclear weapons. Thus, 
early warning systems have grown to extreme importance over 
the last thirty years. 

Looking at the Soviet warning system raises some 
deeply troubling issues. When it is examined as a system, 
and not merely as a physical collection of radars and 
computers, we see a consistency between doctrine and capa- 
bility. The Soviet doctrine is one of pre-emptive attack, 
and the Soviet capability is a system of warning and command 
that supports such a strategy. The Soviet experience of 
invaSion may help to explain the reason for this approach. 

Ever since the Nazi's attack in 1941, the Kremlin 
proscribed to the concepts of surprise attack, pre-emptive 
attack, and automatic firing. These policies fuel our 
apprehensions about the Soviets, particularly during times 
of crisis. As recently as July 1982, Defense Minister 
Dimitri Ustinov iterated the idea that the United States 
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should be denied the freedom of first use of nuclear 
weapons. At the same time, he hinted at renewed Soviet 
interest in a launch-on-warning policy. It is a mistake to 
discount Soviet statements as mere political bluff. Soviet 
threats contain exaggeration, but they also have a rationale 
that gives us insight into their thinking. Automatic or 
quick-launch systems are a preeminent design goal for the 
Soviet ICBM forces. These capabilities are not a by-product 
of Soviet technology; they are a guiding principle, and they 
continue to be an integral feature of the Strategic Rocket 
Forces (SRF). 

The emphasis on pre-emption in Soviet peacetine 
doctrine is, of course, no guarantee that pre-emption would 
actually be used in a crisis. However, just the knowledge 
of a pre-emptive philosophy adds to our fear of surprise 
attack from Soviet forces. Also, it is unimaginable that 
the Soviets would operate their nuclear forces in a launch- 
on-warning mode during peacetime. The chief consequence of 
their emphasis on pre-emption may be that it serves as an 
indoctrinating force throughout their defense organization. 
However, once a country incorporates a view of war into the 
planning process, competing theories of conflict will prob- 
ably receive less attention. By building an arsenal anda 
training system directed toward pre-emptive attack, the 
Soviets preclude alternative strategies from consideration. 
Thus, it becomes more unlikely that plans could change at 
the last moment in a crisis. Now, in the 1980s, the Soviets 
have reached a virtual nuclear parity with the United 
States. With an increase in the certainty of a successful 
pre-emptive attack may come an increase in the probability 
of nuclear war if East-West tensions are not reduced 
[ Reb. 2] 
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2. The Causes of the Concern 


The major threatening influence on the evolution of 
our warning system is the stationing of Soviet nuclear- 
firing submarines near the coastlines of the United States. 
Up until the late 1960s, Soviet submarines were located 
under the Arctic ice cap. A launch of a Submarine-Launched 
Ballistic Missile (hereafter, SLBM) from that position 
provided some time for decision makers to discuss and recon- 
mend appropriate responses to that threat. Now, Soviet 
Yankee and Delta class submarines regularly patrol near our 
coasts [Ref. 3]. Depending on tactics and firing position, 
these submarines could fire SLBMs at our bomber bases and 
command centers with flight times ranging between 4 and 15 
Minutes. Then, they can aim at Washington, the North 
American Aerospace Defense Command (NORAD), and the 
Strategic Air Command (SAC) in an effort to paralyze the 
retaliatory forces of the United States. Even if our forces 
would be paralyzed only temporarily, an SLBM attack allows 
enough time to follow up with an all-out ICBM attack from 
Soviet missile fields. 

Another cause for concern is Soviet rhetoric. In 
the spring of 1983, Anatoly Alexandrov, the President of the 


Soviet Academy of Sciences, announced: 


"The Soviet Union will e a policy of automatic. 
massive retaliation against all potential enemies if the 
new American medium-range nuclear missiles are deployed 
in Western Europe." ([ Ref. 


Although the Soviets frequently hint at using a launch-on- 
warning posture, Alexandrov's remarks are more definite than 
previous statements of the Soviet position. Alexandrov 
claims that the current balance of strategic forces allows 
roughly 30 minutes for both sides to take steps to avoid a 


nuclear confrontation. (This refers to the ICBM forces, but 
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not the SLBM forces.) He claims that the deployment of 
missiles in Europe would limit this time span to 5-7 
minutes; thus, precluding chances to avert an all-out 
confrontation. However, he fails to mention the SLBM threat 
which has about the same time span to avert a confrontation: 
5-9 minutes versus 25-30 minutes for ICBMs. Although the 
Soviet ICBM threat is potentially nore destructive to our 
retaliatory forces, the SLBM threat severely shortens 
decision-making time which affects the launching of retalia- 
tory forces. 

The mechanisms which might precipitate an uninten- 
tional or accidental nuclear war entail our steady 
progression of technological advances in equipment, such as 
satellite sensors, and increasingly sophisticated computer 
software. These enhanced capabilities allow faster evalua- 
tion of events that take place in the atmosphere or space, 
as well as on the ground, and they provide a clearer picture 
of the global military situation. Yet, errors in the data 
gathering function (which includes all sensors, communica- 
tion links, and conputer systems) already have caused false 
alarms at NORAD, our main surveillance center. In this 
discussion, a false alarm is a display from the data gath- 
ering system which indicates the launch of missiles towards 
a United States defended area with impact points in that 
area, but is, in fact, not real. Routine missile displays 
do occur every year, but NORAD does not label these as false 
alarms. Rather, NORAD resolves these routine missile 
displays using the usual surveillance procedures prior to 
any need for decisions from higher authority. 

Four false alarms, occurring in the fall of 1979 and 
the spring of 1980, received international attention 
(Ref. 5: p. 8]. However, NORAD located and corrected the 
problems surrounding these alarms without an inadvertent 


launch of retaliatory forces. Since then, the added care 
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taken in the entire missile warning system has helped to 
resolve incoming missile displays sooner, severely 
curtailing false alarms. No false alarms have occurred 
since 1980. 

Another contribution to the cause of accidental 
nuclear war is the greater international tension brought 
about by our increased nuclear stance and the inclusion of 
the Star Wars weapons system in our arsenal. This means 
that the United States is willing to take a risk to protect 
itself from the threat of an attack by establishing a 
launch-under-attack policy. Most Americans believe that 
their nation is not morally capable of initiating a nuclear 
war under any Situation. Yet, the initiation of a policy, 
like launch-under-attack or launch-on-warning, sends a 
Signal to our potential enemies. It is inportant in the 
interest of peace that the Soviets clearly perceive our true 


intentions. 


3. The Problem of Accidental Nuclea 


The main goal of the United States military is to 
enhance the capabilities of our weapons if we must use then, 
and to increase weapon survivability if we are pre-emptively 
attacked. But we also desire the possibility of launching 
our weapons to be zero when we are not under attack. Ve can 
describe this conflict using a Type I/Type II error model. 

A Type I error occurs when an attack is coming, but the 
warning process fails and indicates that we are not under 
attack; thus, no counter-strike is launched. A Type ITI 
error occurs when no attack is forthcoming, but the warning 
process fails and indicates that we are under attack; thus, 
a counter-strike is launched when no threat exists, leading 
to an accidental nuclear war. The matrix in Figure 2.1 


below delineates the possibilities: 
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UNDER ATTACK NO ATTACK 


TYPE Il ERROR 
* 


COUNTERSTRIKE 


TYPE ! PRROR 
x 


NO COUNTERSTRIKE 


ee ER a Ge EE ET GETTER n n e 








Figure 2.1 Type I/Type II Error Matrix 


The two error types occur where the asterisks (*) 
are located. On the one hand, we want to lower the 
probability of not launching a retaliatory strike when we 
are under attack (the military does not want to make this 
mistake). On the other hand, we also want to lower the 
probability of launching a retaliatory strike when we are 
not under attack (i. e., causing an unintentional nuclear 
war). Note the trade-off involved with the two error types: 
we can not lower the probability of one error type without 
raising the probability of the other, due to the very nature 
of Type I/Type II errors. But we can continue to search for 
a policy which gives the best balance between Tvpe I and 
impe II-errors. 


4. Previous Investigations of the Problen 


The incidents of false alarms at NORAD generated 
several studies and sparked a renewed interest in launch 


policies. These studies focused on a need to watch false 
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alarms, since a false alarm that is not resolved could lead 


to accidental nuclear war. 


Bereanu built an analytical model on the self- 


activation of a nuclear weapons system (Refs. 6,7]. 


120 161 assumes that both the United States and Soviet warning 


and launch systems are interconnected: 
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Figure 2.2 The Bereanu Model 
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This gigantic system contains four components--the United 
States warning system, the United States launch system, the 
Soviet warning system, and the Soviet launch systen. 
Bereanu argues that if the United States warning system 
responds to an alarm, it will automatically trigger the 
United States launch system which automatically triggers 
the Soviet warning system which automatically triggers the 
Soviet launch system all of which leads to a nuclear war. 
And, if this was a false alarm, it would lead to an acci- 
dental nuclear war. 

Bereanu's model also assumes that more and more of 
the human decision making will be turned over to a computer 
system. Thus, Bereanu implies that if the computer system 
errs and reports a missile launch when, in fact, no launch 
has occurred, the decision maker will automatically respond 
in kind; that is, launch a missile in retaliation. However, 
is the total system interlocked and automatic? This ques- 
tion will be addressed in the following chapters. 

Sennott and Crissey developed a computer simulation 
model and a queuing theory model to show how increasing 
false alarms lead to an increase in the probability of acci- 
dental nuclear war (Ref. 8]. The basis of their study 
revolves around the apparent increasing number of false 
alarms, but using a different definition of false alarm than 
we use in this paper. Sennott and Crissey define "false 
alarms" as conferences called to evaluate possible threats 
(which are otherwise known as missile display conferences) 
and use the data to predict the frequency of such threats in 
their models. They then claim that accidental nuclear war 
will occur if a false alarm takes too long to resolve. That 
is, if the time required to resolve the alarm exceeds the 
use them or lose them point, then retaliation is automatic. 
They also equated false alerts with threat assessment 


conferences. However, these definitions do not coincide 
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with NORAD's definition of a false alarm (which is incorpo- 
rated into our definition), and this difference may affect 
the conclusions of their research. 

Steinbruner discusses the background of the launch- 
under-attack policy, an ICBM scenario, and then centers on 
the command, control, and communications (C3) problem 
[Ref. 9]. He also includes the Brookings model written by 
Morawski and Blair. This model simulates the performance of 
the C3 system under four kinds of damage conditions and 
investigates the ability of the system to retaliate. The 
article concludes by stating that even our considering a 
launch-under-attack policy demonstrates the increasing 
tensions between ourselves and the Soviets. 

The authors mentioned above (as well as others 
referenced) hold the common view that the world is on the 
brink of accidental nuclear war. With increasei interna- 
tional tension, coupled with the increasing number of 
missile displays, this conclusion might appear true on the 
surface. Even using the definition of a false alarm as 
delineated by Sennott et al, the apparent increase in these 
alarms may be explained by the following facts: (1) more 
sensitive sensors are on line and operators must continue to 
calibrate, test, and evaluate them; (2) the Soviets have 
increased their testing of missiles; and (3) the Joint 
Chiefs of Staff have revised the criteria for convening 
missile display conferences. Even if intelligence provides 
information regarding a test shot, NORAD continues to 
monitor, evaluate, and test its system on these live 
launches. Thus, the detection of any launch is added to the 
permanent record. 

Several of the authors assumed that the man-in-the- 
loop would lose control of the decision-making process by 
being left out at certain points in the process, or that the 


data gathering system makes the man-in-the-loop's decision 


20 


more automatic. On that basis, the decision to launch is 
then automatically carried out by the computer system. This 
view misses the intimate relationship between warning and 
alert levels on the one hand, and control of offensive 
weapons on the other. It also fails to consider the checks 
and balances (that is, the man-in-the-loop) set up 
throughout the entire missile warning systen. 

Many differing opinions concerning different policy 
types and policy definitions exist among the authors cited. 
Sennott et al define launch-on-warning to mean if a situ- 
ation can not be called a non-threat, then it is a threat; 
therefore, launch [Ref. 8: p. 2]. However, this definition 
does not completely cover the current decision process 
employed by NORAD. Steinbruner's definition is very vague; 
he defines launch-under-attack (equal to launch-on-warning) 
as launching missiles after acquiring reliable evidence that 
a Soviet attack is underway before its actual effects are 
felt [Ref. 9: p. 37]. Bracken uses the term automatic 
retaliation, but defines launch-on-warning to include the 
nilitary decision makers, who are given emergency authority 
to use nuclear weapons in advance of hostilities, and who 
are further instructed to use this authority if indications 
of an attack arise. Then, Bracken states that a launch-on- 
warning strategy does not require any computers or radar, 
although they are necessary to implement such a strategy 
smoothly. 

Although many different launch policies appear in 
different articles, only two stand out as viable alter- 
natives--launch-under-attack and launch-on-warning. As 
described above, definitions of these policies vary widely, 
depending on the source. We offer clearer definitions in 
Chapter V and further pursue their implications. 

In all the cited articles, the authors hardly 


considered NORAD, left out the actual decision process, and 
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over-simplified or overlooked many assumptions. Although 
these discussions thoroughly delineated the problem, little 
has been written to answer the questions they raise. We 
investigate and discuss these questions in Chapters III and 


IV. 


B. METHODOLOGY OF THIS STUDY 


In the next two chapters, we discuss two parts of the 
missile warning function--data gathering and decision 
making, These two separate, yet interrelated, parts demon- 
strate the role the man-in-the-loop plays and the importance 
of maintaining this role as we consider the implications of 
certain launch policies. 

The Data Sathering Model completely covers all of the 
mechanical aspects--sensors, ground stations, command 
posts--as well as describing decision rules, such as dual 
phenomenology. The Data Gathering Model also presents 
several scenarios of interest with an accompanying sensi- 
tivity analysis to show how time affects the decision-making 
process. 

The Decision Model adds decision points to the Data 
Gathering Model and incorporates in greater detail the same 
Scenarios from the Data Gathering Model. The sensitivity 
analysis further directs attention toward the need for a 
policy to balance the current situation. In Chapter V, we 
discuss two types of launch policies and their implications. 
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III. DATA GATHERING MODEL 


A. | THE CURRENT MISSILE ATTACK WARNING SYSTEM 


The Missile Attack Warning System consists of three 
parts: (1) sensors to detect a missile launch, (2) computer 
centers and communication links to process and distribute 
the data from the warning system, and (3) command posts 
which analyze data and assess the implications of the 
warning information and direct appropriate actions. Major 


components of each of the above parts follow: 
1. Missile Warning Sensors 
a. Satellite Early Warning System (SEWS) 


--detects infrared trail of a burning missile motor 


--provides overlapping coverage for the Soviet Union and 


China (for ICBMs) 


--provides overlapping coverage for the Atlantic and 


Pacific Oceans (for SLBMs) 


--transmits real-time information due to the nature of the 


SLBM detection problen 


--ground stations process and forward data to the command 


posts 
b. Ballistic Missile Early Warning System (BMEWS) 


(1) Large Tracking Radar in Greenland, England, 


and Alaska. 


--detects and continuously searches for an object 


--Operates on several UHF frequencies 
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--provides precise data on the character and magnitude of 
a missile attack 
(2) Static Radar in Greenland and Alaska. 


--evaluates missile position and velocity 


--calculates the trajectory, impact point, impact time, 


and launch point 
C. Pave Paws 


--a large multi-targeting phased array radar in California 


and Massachusetts 
--operated and maintained by the Strategic Air Command 
--primarily detects SLBMs 


--relays the characterization of the attack to NORAD, SAC, 
and the National Command Authorities (NCA) 


--sinultaneously detects and discriminates many objects 
while providing early warning data, launch, impact, 


position, and velocity information 


--provides automatic detection, track initiation, and 


mission decisions 
--operates at UHF frequencies 


d. Perimeter Acquisition Radar Attack Character- 
ization System (PARCS) 


--located in North Dakota 
--tracks incoming ICBMs 
--directs the launching of missiles 


--Very accurate 
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e. Two Radars in the Southern United States 
--long range phased array radars 
--uses pattern recognition of current space objects 


--back-up system performs a full search with human 


intervention 
--operates on UHF frequencies 
--supplements SLBM detection from the Gulf of Mexico 


--receives inputs from BMEWS and the United States Navy 


Space Surveillance (SPASUR) network 
f. Cobra Dane 


--a large, real-time tracking phased array radar in the 
Aleutian Islands of Alaska 


--detects and tracks ICBMs, SLBMs, and satellites 
--predicts impact points 
--primarily collects intelligence data 

Zia round Processing and Communication System 


--ground stations in the continental United States and 


overseas which process the data from the sensors 


--communication processing stations co-located with the 


Sensors 


A thorough discussion of the communication function follows 


later in this chapter. 
3. Command Posts 
a. North American Aerospace Defense Command (NORAD) 


--described later in Section D of this chapter 
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b. Strategic Air Command (SAC) 
--located (underground) in Omaha, Nebraska 


--has the authority and responsibility to launch the 


nuclear bomber force to protect it 


--maintains a small percentage of the bomber force on 


constant alert 


--operates and constantly maintains an airborne command 


post 
C. National Military Command Center (NMCC) 
--located in the Pentagon 
--anticipates and evaluates foreign crises 


--point of contact for the President to obtain information 


and command the nuclear forces 


d. Alternate National Military Command Center 
(ANMCC) 


--located (underground) in Fort Richie, Maryland 


--acts as the alternate location for NMCC with the same 


functions as NMCC 


The missile warning system employs a two-step process 
for identifying a missile launch and assessing the threat to 
the North American continent. First, the infrared warning 
satellites detect the infrared signature of a burning 
missile motor.  Ground-based radars provide back-up confir- 
mation data and rely on detection using a different physical 
phenomenon; i. e., radar tracking of a physical object as 
opposed to detecting the infrared signature. This two-step 


lihood of mistaking some natural phenomenon for a launch of 
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an eneny's missile. For the purposes of this thesis, dual 
phenomenology means the use of different types or families 
of sensors to detect the same launch. 

The BMEWS radar confirms and characterizes a polar ICBM 
attack.  Pave Paws radar detects SLBM launches and SEWS 
covers both ICBMs and SLBMs. Thus, after the detection of 
an infrared signature, the BMEWS radars would be the first 
to detect ICBMs; the Pave Paws radar would be the first to 
detect SLBMs launched off either coast. The two radars in 
Florida perform the same function as the Pave Paws radar for 
missiles coming from the Gulf of Mexico. 

The satellites and Pave Paws radar, the two sensors that 
detect the attack of SLBMs, feed their data directly to all 
four major command posts (so all four receive and evaluate 
the data simultaneously). In addition, NORAD transmits its 
analysis of any SLBM attack to the other three command 
posts. Thus, the duty officers at the other sites have two 
separate computations and displays of the SLBM launches. 
Data from all other warning sensors feed only into the NORAD 
command post, where it is analyzed. The other three command 
posts then receive the results of the NORAD analysis by 
transmission over the communication lines. 

In order to ensure that the communication lines between 
NORAD and the other three command posts remain open, NORAD 
constantly transmits messages to the other sites over 
circuits that would transmit an actual attack. Normally, 
this message contains test data so that all three sites can 
monitor the condition of their communication links fron 
NORAD. If the system works properly, all command posts 
receive Similar information. When any indication of a real 
threat exists, including ambiguous data, the four command 
posts begin a conferencing procedure to evaluate and assess 
the data available. 
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If the Soviets launch SLBMs and ICBMs separately or 
simultaneously, the following sequence of events probably 


would occur: 


1. Satellites detect launches of SLBMs or ICBMs shortly 


after launch. 


2. Pave Paws radar picks up the SLBMs 2-5 minutes after 


launch, 


3. BMEWS radar picks up the ICBMs within 10 minutes of 


their launch, 


4. PARCS radar picks up the ICBMs in the terminal phase 
of flight. 


Approximately 9-12 minutes exist between launch and impact 
of an SLBM. Time between launch and impact of an ICBM is 
approximately 25-30 minutes. Since an SLBM can destroy a 
large portion of our ground-based sensors and command posts, 
the time our current system is fully operational could be 
severely shortened. This does not mean that the entire 
system would disappear at the end of the approximate 9 nin- 
ute period. But then we could only depend on those assets 
that survive the initial attack; that is, assets that are 
airborne in time to escape the attack. Thus, the short 
interim between detection of an attack and destruction of 
the major portion of our command and control structure puts 


a severe stress on the decision maker. 


B. SENSOR PROCESSING 


The sensor evaluation process entails the following 


Steps: 
1. An event triggers a sensor. 


2. The satellite sensor relays a signal to its respective 


ground station. 
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3. The sensor ground station computer interprets the 


radar signals. 
4. The computer system analyzes the signals. 


5. The computer system relays its analysis to the system 


operator. 


6. The computer systen generates a message to the command 


posts, 


7. The command post verifies if an actual message was 


sent. 


8. The sensors continue to follow the path of the object 


and send update messages. 


In every step of the above procedure, the man-in-the- 
loop observes and evaluates the processed data. Therefore, 
the processed data will be declared a false alarm if, in the 
experience of the man-in-the-loop, the processed warning 
data indicates a false display of a launch which may be 
caused by some natural phenomenon, or the man-in-the-loop 
has little confidence in what the computer system tells hin 
about the supposed threat. Likewise, if a computer compo- 
nent fails, perhaps generating a false display, but the 
Sensors never register a missile launch, then the man-in- 


the-loop will also recognize this as a false alarm. 


C. COMMAND CENTER PROCESSING 


Both NORAD and SAC receive missile warning data from 
SENS and Pave Paws radars. NORAD receives data from BMEWS, 
Cobra Dane, and PARCS radars and sends summary messages to 
SAC. NMCC and ANMCC receive only a Summary of the missile 
warning data from NORAD. Since NORAD obtains more informa- 


tion (ICBM and SLBM data) than any other command post in the 
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system, the Commander-in-Chief of NORAD (hereafter, CINC 
NORAD) assesses the sensor warning data. 

If the data gathering system indicates a launch, 
specialized centers in the Cheyenne Mountain Complex are 
activated. The Missile Warning Center calls the individual 
sensor sites to confirm the validity of the indication of 
launched missiles. The Space Center states whether the 
indicator is or is not one of the over 4,000 objects already 
in space. The Solar Center reports any solar activity. The 
Intelligence Center discloses any information which would 
add to the definition of the indicator. With all this 
information combined, CINC NORAD makes a total assessment of 
whether the indicator is a real launch threat to North 
America. 

If the satellites trigger the warning process, any one 
of the four command posts can call a conference. At the 
conference, CINC NORAD makes decisions regarding the 
threat/no threat situation evaluated by the sensors with 
inputs from the other command posts. We discuss this 


conferencing procedure in detail in Chapter IV. 


D. | NORAD'5 ORGANIZATION AND MISSION 


1. The Early History of NORAD 


To better understand the Data Gathering Mođel, and 
later, the Decision Model, it is important to realize where 
NORAD fits into the picture and how NORAD's mission affects 
the question of accidental nuclear war. 

By the mid-fifties, the United States Air Force had 
the technology of continuous warning information. Only by 
redesigning their formal organizational structure to fit 
this new information technology could the Air Force pros- 
ecute a war successfully. This resulted in the creation of 


NORAD in 1957. | As the central processor of real-time 
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Warning information, NORAD became a joint United States- 
Canadian command because of the location of radars anc 
fighter bases in Canada. Its job included the integration 
of BMEWS, Sound Surveillance System (SOSUS), Distant Early 
Warning (DEW) Line, and other information sources for an 
overall warning estimate that would be relayed to other 
command centers, such as SAC and the Pentagon. 

NORAD is the central command post for continuously 
monitoring warning and intelligence information from 
multiple sources. It is, then, the central coordinating 
institution responsible for determining when the United 
States is under attack. 

NORAD serves a critical alerting role in an elabo- 
rate system of institutional checks and balances to prevent 
unauthorized or inadvertent use of nuclear weapons, either 
of which could lead to a nuclear war. The Commander-in- 
Chief of SAC (hereafter, CINC SAC) does have tne authority 
to order the launch of the bomber force in order to prevent 
its destruction on the ground by incoming enemy missiles. 
However, this authority depends crucially on the threat of 


incoming enemy attack, a condition determined by CINC NORAD. 
2. Today's NORAD 


Today, NORAD is a bi-national partnership between 
the United States and Canada; CINC NORAD is also the 
commander of the United States component, the Aerospace 
Defense Command (ADCOM). Canadian forces come from the 
Canadian Forces Air Defense Group, headquartered at North 
Bay, Ontario. The senior representative of the Canadian 
Forces is the Vice Commander-in-Chief of NORAD. CINC NORAD 
reports to the Joint Chiefs of Staff (JCS) as representing 
the Specified Command, ADCOM. As the Commander of Aerospace 
Defense Center, he reports directly to the Chief of Staff of 
the Air Force. 
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The NORAD mission includes: 


(1) Tactical warning and attack assessment of bomber or 


ballistic missile attack on North America 


(2) Space surveillance, tracking, and cataloging of all 


human-nade objects in space 


(3) Satellite protection of friendly satellites, pro- 
viding collision-avoidance and other flight 


condition information 


(4) Satellite attack warning and verification for all 
United States satellites 


(5) Peacetime surveillance, detection, and identification 


Of alrcmart 
(6) Support for the Space Shuttle missions 


(7) Operational control of United States and Canadian Air 


Defense Forces 


Also, NORAD has the responsibility to JCS to provide worid- 
wide detection of missile launches and nuclear events. This 
includes the Pacific area and Europe, as well as the area 
adjacent to the North American Continent. 

To accomplish its mission, NORAD exercises opera- 
tional control of the detection and communications systems, 
and it operates and maintains the analytical systems in the 
NORAD Cheyenne Mountain Complex (NCMC).  NCMC provides NCA 
and CINC SAC with real-time missile warming messages and 
NORAD confidence assessments. 

The NORAD command post is in the underground 
Cheyenne Mountain Complex in Colorado. A worldwide network 
of sensors gathers and processes missile warning information 
and distributes warning messages to other United States and 
Canadian command posts. 
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NORAD does not engage in any active defense such as 
ballistic missile defenses designed to intercept ICBMs and 
SLBMs. This task is reserved for SAC. Specifically, NORAD 
employs passive defenses that protect targets by such means 


as warning, mobility, and sheltering forces. 


E. DATA GATHERING HODEL FORMULATION 


In order to formulate the Data Gathering Model, we must 
establish several basic assumptions about the data gathering 
process. Three examples then illustrate the importance of 
time: we will model an ICBM Scenario, an SLBM Scenario, and 
a test shot scenario. i 

First, we assume the timely detection of inconing 
missiles. Timely detection of missiles determines how 
quickly a response to an actual or imagined threat can be 
made. Success in preventing an accidental nuclear war, or 
in protecting strategic forces, depends on the fastest 
possible identification: the sooner an incoming object is 
identified as a threat or non-threat, the more time is 
available for decision makers to consider appropriate 
responses. 

Second, we assume that communications remain intact over 
the entire system until the missiles impact. This assump- 
tion requires some explanation. As discussed in Steinbruner 
[Ref. 9: p. 40], an electromagnetic pulse (EMP) from an 
exoatmospheric nuclear explosion would cause interruption of 
non-hardened and long range (HF, LF) communications. To 
overcome the effects of EMP, redundant messages sent over 
the communication lines contain less information, ensuring 
that some information gets through the system. However, it 
takes at least 7 minutes after an SLBM launch before the 
first exoatmospheric explosion occurs. Also, we will not 
consider sabotage or human errors which could also disrupt 


communications. 
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Third, we assume that the computer system, which 
contains a large number of components (both hardware and 
software), has high reliability. Performance of the missile 
warning task requires the use of computers and high-speed 
communication systems which both sometimes produce erroneous 
data. However, dependency on computers does not imply 
control by them, since the data gathering system only 
reports and evaluates missile warning data while a 
for launching missiles. At every step of the process, 
experienced personnel evaluate and judge the meaning of the 
incoming data. Only these trained personnel can direct any 
action in response to what the warning system reports. 
Thorough investigations of previous false alarms led to more 
stringent policies and practices throughout the missile 
warning system, severly curtailing the possibility of an 
inadvertent launch. The additional vigilance of the man-in- 


the-loop makes inadvertent launches even less likely. 


1. The Generic Model 


As stated before, the Data Gathering Model consists 
of a continuous time line broken into finitely many (some- 


times overlapping) segments, each of finite duration: 


tine of flight x caian eee 
launch impact 
Figure 3. 1 The Generic Data Gathering Model 
where tO = time of launch 
t1 = first detection 
t2 = system evaluation of launch (threat/no 
threat) 
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t3 = second detection 

t4 = assessment of launch by decision makers 
(threat/no threat) 

t5 = last possible time to decide on the 
type of response (launch/no launch) 

t6 = time of impact 


The time line, over which observations are taking 
place, starts with the friendly forces detecting the 
launching of missiles, and ends with the impact of missiles. 
Fach t(i) is the time when the data gathering system de- 
tects, evaluates, and completes its analysis of the sensor 
data and passes along the information to the decision-making 
system so evaluation of the threat can be resolved prior to 
impact. The minimum time to resolution (that is, the min- 
imum amount of time in which to make a decision to launch or 
(t5-t3). Note that t0, t5, and t6 are fixed 


points, and if t4 is greater than t5, a serious problem 


not launch) 
arises. In the following examples, the time sequence 
remains the same. 
2. Examples 
a. ICBM Scenario 


Starting with the least stressful situation, an 


ICBM launch scenario, the model describes the following: 


PS‏ ی من رده 
E x ò ۱ 3 i Bi I = 73b 773 ninutes‏ 
launch inpact‏ 


Figure 3.2 An ICBM Scenario 
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As in the general case above, the definitions of t0 through 
t6 remain the same. The minimum time to resolution of the 
threat is (t5-t3) = 22 minutes. 


b. SLBM Scenario 


The model below describes an SLBM launch 


scenario: 


EO انا‎ t2 t3 t4 t5 t6 


tine of flight a ra eR cx 


launch impact 


Figure 3.3 An SLBM Scenario 


Again, the definitions for t0 through t6 remain 
the same. Notice that the time of flight for the SLBMs 
extremely shortens the amount of decision and response time. 


Here, the minimum time to resolution is (t5-t3) = 4 minutes. 
C. Test Shot Scenario 


The model below describes the situation where 


the data gathering system monitors test shots of missiles: 


۱ sonuimn. 0 i | t6 
time of ilight ۳ === |---| 72 minutes 


launch impact 


Figure 3.4 A Test Shot Scenario 


Usually, in a test shot, the Intelligence Center 
informs CINC NORAD that a test shot has been scheduled. 
However, whether or not intelligence is available, the data 
gathering system treats a test shot as a regular launch and 
calculates an impact point. By t3, the decision makers 


realize it is a test shot, but continue the assessment 
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process for intelligence gathering. In this example, the 


ninimum time to resolution is (t5-t3) = 4 minutes. 


F. SENSITIVITY ANALYSIS 


The critical area of sensitivity analysis lies in the 
data processing times in the above three examples. The 
longer it takes to process incoming data, the less time 
remains to make important decisions on whether we should 
launch our missiles. Thus, shorter processing times buy 
more decision time (which becomes more precious as the 
Scenarios get more complex). 

Some uncertainty exists in the Data Gathering Model. 

For instance, sensors and computer hardware components do 
fail, computer software is not totally error free, and 
conputer operators do make errors. All of these failures 
have occurred at least once at NORAD [Ref. 5: pp. 5-9]. 
However, in every case, NORAD did discover the error and 
improve its data gathering system. 

In reality, the time segments of the above Data 
Gathering Model are not as neat and precise as described. 

As stated before, these segments overlap and, sometimes, one 
event will occur before another. 

Since satellites view the world from one vantage point 
and ground stations view it from another, some discrepancies 
arise that could cause problems. For instance, if SEWS 
picks up a launch in one place, but Pave Paws picks it up in 
another, the system may display two launches even though 
only one has actually occurred. Sometimes 4-5 missiles look 
like 30, eSpecially when debris is present. These possibil- 
ities make it harder for the decision maker to state high or 
low confidence in the assessment to the President and have 


an effect on the President's own response decision. 
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In the scenarios below, we explore the ramifications of 


the overlapping time segments. 


1. T 


The interval between t0 and t1 is split into two 
parts. In the first 30 seconds, a quick took report flags 
some phenomenon which could be a launch. In the next 1.5 
minutes, the initial report follows with the probable point 
of launch (the azimuth) and the direction of launch. This 
information assists the decision maker in determining 
whether the launch is real or the system has failed. Since 
processing occurs in the satellite and at ground stations, 
the time from t0 to t1 could be more than 2 minutes, when 
the system delays to discriminate between a natural phenon- 
enon and a real launch, or when the decision maker calls a 
ground station to confirm the display on the command post's 
computer monitor. In any case, when several satellites pick 
up a possible launch, the data gathering system automati- 
cally attempts to merge the individual reports into a single 
message, then transmits this message to the decision maker. 

In the interval between t1 and t2 (about 30 sec- 
onds), the data gathering system evaluates the possible 
launch, and by t2, labels it a threat/no threat. The next 
interval, from t2 to t3, which allows time for a second 
detection, can become quite large. Depending on what sensor 
picks up the launch, and the launch trajectory, this 
interval could be anywhere between 3 and 7 minutes in 
length. The interval between t3 and t4 is approximately 30 
Seconds. Figure 3.5 graphically represents these overlap- 
ping intervals. 

We now explain the reason for the 3-7 minute 
interval from t2 to t3. There are four major phases in 
launching an ICBM: boost, post-boost, mid-course, and 
re-entry. The boost phase usually lasts several hundred 
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Figure 3.5 The ICBM Time Line 


seconds, during which the missile starts at rest and accel- 
erates to about 7 kilometers/second by the time it reaches 
an altitude of about 200 kilometers. Typically, an ICBM is 
a three-stage rocket, each stage contributing more than 2 
kilometers/second to the missile velocity. During the boost 
phase, satellite sensors can easily detect the launch, and 
the missile is relatively vulnerable. 

In sophisticated missile systems, a post-boost or 
deployment phase follows the boost. This phase may last 
another several hundred seconds. During this phase, a post- 
boost vehicle maneuvers to achieve a variety of very precise 
trajectories, and then deploys individual re-entry vehicles 
on each trajectory. The post-boost vehicle carries a very 
accurate inertial guidance system to determine its position 
and velocity. It maneuvers to correct any trajectory errors 
produced during the boost phase and places the individual 
re-entry vehicles on slightly different trajectories to 
attack different targets. The individual re-entry vehicles 
are commonly known as Multiple Independently Targetable 
Re-entry Vehicles (MIRVs). Since the post-boost vehicle 
uses a much lower thrust level than the booster, the rocket 
exhaust is much less visible to sensors. 

After the re-entry vehicles are deployed, they 
follow their respective trajectories for approximately 1000 
seconds, climbing to 1000 kilometers, and then falling 


towards the earth, eventually re-entering the atmosphere. 


3/8 


This is the mid-course phase. The final phase is re-entry 
and lasts from 30 to 100 seconds, depending on the specific 
trajectory anł ârag characteristics of theire contry ehl 


Figure 3.6 depicts three types of trajectories for an ICBM: 
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Figure 3.6 Three Possible ICBM Trajectories 


Lofted trajectories (high re-entry angles) result in 
greater re-entry vehicle deceleration, thus, requiring an 
increased time of flight, since the flight path is longer. 
However, this results in a much higher accuracy in hitting 
the target. 

In depressed trajectories (low re-entry angles), the 
re-entry vehicle heats up more, reducing the accuracy of the 
missile. Note that the Pave Paws radar (for example) will 
not pick up a depressed ICBM trajectory as guickly as it 
picks up the other two types of trajectories. For both 
radar and infrared sensors, the difficulty of the sensor's 
job increases with increased range and increased field of 


view. 
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A given booster delivers a given payload to its 
greatest range on the minimum energy trajectory and, hence, 
is the most likely trajectory. This means that the minimum 
time (shortest interval) to reach t3 for a lofted or minimum 
energy trajectory is about 5.5 minutes. In the ICBM scen- 
ario, 21.5 minutes remain for decision-making time before a 
final response is required, and 24.5 minutes remain before 
impact of the missile. The maximum or longest interval of 
time, (t3-t0) = 9.5 minutes. Since the decision maker will 
probably take 30 seconds to make an assessment of high or 
low confidence, this allows the President about 21 minutes 
in the minimum case, and 17 minutes in the maximum case, to 
make his response (see Table I). 

The minimum interval between t5 and t6 is about 3 
ninutes. This covers the reaction time required to launch 
our missiles in a retaliatory strike. Reaction time 
includes the encryption of messages to launch, the decryp- 
tion of those messages upon receipt, double-checking the 
messages for accuracy (that is, are they real orders?), and 
the required number of personnel on the scene to unlock and 
operate the missile system. Since we have never had to 
perform this function, other than in a training exercise, 
this minimum reaction time does not include any failures of 
components in the launch system preventing the launch, fail- 
ures of any personnel to perform their duties, nor any other 
uncertainties that may occur. A more realistic time is 
closer to 6 minutes. This amount of time accounts for the 
completion of actions from the above 3 minutes, plus any 
extra time for shock, confusion, dismay, denial, and undue 
pressure that would arise from receiving a real launch 
order. However, using 6 minutes as a maximum time required 
to perform the launch seguence still leaves the President 18 
Minutes to decide a response to the threat in the minimum 


case, and 14 minutes in the maximum case. 
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2s The SELBY Threat 


The time intervals up to and including t3 remain the 
same here as in the ICBM scenario. However, the situation 
drastically changes in this scenario due to the much shorter 
time of flight of an SLBM: 
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Figure 3.7 The SLBM Time Line 


Figure 3.8 below depicts the usual SLBM trajectory 
(about 1000 miles from shore) together with a depressed SLBM 
trajectory. This graph reveals that to obtain dual phenome- 
nology (using Pave Paws as an example), the time between t2 
and t3 will increase with a depressed SLBM launch. This 
result severely shortens the time for the decision maker to 
assess the situation. 

The graph in Figure 3.9 shows the usual SLBM trajec- 
tory together with an SLBM launch at 500 miles from the 
coast (about as close as a submarine can get to launch an 
SLBM if it is to hit its target). When launching an SLBM, 
the trajectory will probably be lofted to attain enough 
speed and height to successfully re-enter the atmosphere and 
hit its target. Although this lofted trajectory is less 
accurate in hitting the target, the interval between t2 and 
t3 increases while the overall time of flight (tO to t6) 
decreases. This results in decreasing the decision makers' 
time. Therefore, the closer the launch is made to the 


coast, the less time remains for the decision maker. 
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Figure 3.8 Two Possible SLBM Trajectories 
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Fa gures 3.9 Two Possible SLBM Trajectories 


Recall that the minimum time to reach t3 is 5.5 


minutes. In the SLBM scenario, this time leaves 3.5 minutes 
decision-making time before the last moment a response can 


initiate a retaliatory launch, and 6.5 minutes before the 
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impact of the missile. The maximum time is (05-00) = oe 
minutes, which allows no decision-making time and 2.5 
minutes to impact. This analysis explains why an SLBM 
launch is so stressful for the decision maker. 

The decision maker will probably take about 30 
seconds to make an assessment and state either high or low 
confidence. In the minimum case, this leaves 3 minutes for 
the President to take action. In the maximum case, the 
situation has advanced beyond the cut-off time to initiate a 
launch order. 

With 6 minutes as the maximum time required to 
perform a launch sequence, that is, (t6-t5) = 6 minutes, a 
decision maker would have sufficient time for assessment 
since the minimum resolution time (t3-t0) = 5.5 minutes, but 
if the assessment takes the usual 30 seconds, no time 
remains for the President. If the resolution time is 
anywhere from the minimum (t3-t0) = 5.5 minutes up to 6 
minutes, the United States could still execute an actual 
launch order in time. This situation illustrates that the 
demand for reliability in dual phenomenology and reporting 
high confidence, plus the demand for reliability in a launch 
order, puts the decision maker in a severe time crunch. In 
the case where t4 occurs after t5, or when an SLBM is 
launched from 500 miles vice 1000 miles, the overall systen 
permits no decision-making time at all. 

The new capabilities of the cruise missile present a 
worse case scenario shown in Figure 3.10. Currently, the 
United States has no policy to deal with cruise missile 
launches. With such a short warning time, a bomber attack 
may be the only response possible. Although the cruise 
missile is a limiting case (so we will not discuss it at 
length here), it is an important subject for future investi- 
gations. 
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Figure 3.10 A Cruise Missile Trajectory 


The table below summarizes the times discussed in 


the above analysis: 


TABLE I 
Time Remaining in the Data Gathering Model 


Interval ICBM SL3M 
First Detection 28 10 
System Evaluation 20,5 Je 
Second Detection minimum 24.5 

maximum 2E 6-5 
CINC NORAD's Assessment minimun 24 2 

maximum 27 6 
President's Tine ninimum 17 0 
(3 minutes to impact) maximum 21 3 
President's Tine minimum 14 0 
(6 minutes to impact) maximum 18 
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IV. DECISION MODEL 


A. DESCRIPTION OF THE CURRENT DECISION PROCESS 


The missile warning function involves two major Air 
Force commands--NORAD and SAC. NORAD has the responsibility 
for the management, maintenance, and operation of all the 
early warning sensors, in addition to the overall air and 
space defense of the United States. CINC NORAD has the 
responsibility for the management and operation of the 
command post at the Cheyenne Mountain Complex, plus the 
responsibility for the interpretation of missile warning 
data sent from SAC. 

SAC's responsibilities include maintaining the airborne 
command post, which conveys the launch order if the under- 
ground command post is wiped out. SAC is also responsible 
for operating its computer system, which receives missile 
warning data from SEWS and NORAD.  CINC SAC is personally 
responsible for keeping the bomber and tanker forces in a 
ready status in case they must be launched for surviv- 
ability. When launched, the bomber force does not proceed 
with an attack, but follows orders to go to holding posi- 
tions where it waits for orders either to commence an attack 
or return to base. SAC repeatedly practices this launching 
procedure (using a small percentage of the force) to keep 
the bomber forces continually ready. 

A number of questions concerning ICBM silo vulnerability 
and the missile accuracy of the Soviet SLBMs and ICBMs 
persist. The big question in the decision model is "Will 
our ICBMs be able to ride out an attack?" If we believe in 
silo vulnerability and decide to launch a percentage of the 
ICBMs in the event of a real threat, then the ICBMs are 
committed and can not be recalled. In this situation, the 


decision maker must face the decision to "use them or lose 
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them." On the other hand, the other two legs of the stra- 
tegic triad, submarines and the bomber force, are less vuln- 
erable when deployed. These forces also remain under strict 
human control at all times. Bombers can be recalled easily 
from their holding stations, but the submarine forces have 
more flexible instructions. These instructions restrain 
submarine commanders from launching missiles without author- 
ization or allow them to maintain a neutral position. 

Generally, the more missiles launched, the easier it is 
to decide a threat/no threat situation, since a massive 
launch strongly indicates a real attack. The problem arises 
when only one missile appears, if the sensors detect some 
natural phenomenon, if spurious warning data enters the data 
gathering system, or if a component in the system fails. If 
the indication of a launch comes from the ocean, this 
heightens the problem even more, since less time is avail- 
able to evaluate, assess, and respond to the threat. If 
CINC NORAD assesses a single missile threat with high confi- 
dence, the President's decision problem becomes extremely 
difficeudt. 

Next, we discuss three major components of the Decision 
Model conference procedure: (1) the missile display confer- 
ence, (2) the threat assessment conference, and (3) the 


nissile attack conference. 


1. The Missile Display Conference 


Upon detecting a possible launch, the missile 
warning system passes its analysis of threat/no threat to a 
decision maker, and a formal missile display conferencing 
procedure convenes to evaluate and assess the analysis. Any 
of the four duty officers at the command posts may call this 
initial conference, if the data gathering systen at the 
command post indicates a possible threat. CINC NORAD calls 


a routine missile display conference whenever changes to the 
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system (such as position or configuration changes to 
Sensors), cause unusual information or conflicting data to 
appear. 

Since we must maintain a highly sensitive systen, 
Many indications of detections arise that are evaluated as 
not being associated with a real missile launch. Every year 
nany nissile display conferences are called to deal with 
events other than potentially threatening or ambiguous 
missile launches. 

CINC NORAD officially terminates a missile display 
conference when the decision makers judge the available data 
to indicate either the presence or absence of a threat to 
North America. If the perceived threat turns out to be some 
hatural phenomenon such as a solar reflection, CINC NORAD 
terminates the missile display conference, declaring the 
Situation as no threat. System operators at NORAD call the 
ground sites to confirm what appears on their displays. if 
nothing appears on the displays at the ground sites, the 
system operators at NORAD will then trace the problem, but 
CINC NORAD will not call a threat assessment conference (the 
next conference in the decision process). However, if the 
situation at NORAD agrees with the display at the ground 
stations, it is considered a threat. CINC NORAD then termi- 
nates the missile display conference and takes the next step 


by calling a threat assessment conference. 


2. The Threat Assessment Conference 


Às stated above, if CINC NORAD judges a launch to be 
a threat by confirming the incoming data with the ground 
Sites, he convenes a threat assessuent conference. This 
conference requires the addition of more senior personnel to 
assist the duty officers at the various command posts in 
their evaluation of the confirmed threat. Senior personnel 
include the Chairman of the Joint Chiefs of Staff. These 
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personnel confer in order to determine the nature and magni- 
tude of the threat to North America, and they direct prelin- 
inary steps to be taken to enhance force survivability (such 
as preparing for a SAC take-off.)  CINC NORAD's assessment 
will contain either high or low confidence in what the 
Sensors reveal. At this time, if the ground stations report 
a confirmation by more than one family of sensors, then CINC 


NORAD reports high confidence in the confirmed threat. 


3. The Missile Attack Conference 
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If CINC NORAD's assessment to the President contains 
high confidence, CINC NORAD then convenes a missile attack 
conference which includes all senior personnel and the 
President. No missile attack conference has ever been 
called. To arrive at a missile attack conference, the 
conclusions of the two previous conferences revealed that an 
attack on North America is imminent. Since it takes time to 


convene these conferences, time is at a premium. 


B. UNCERTAINTY IN THE DECISION-MAKING PROCESS 


Nuclear deterrence depends on maintaining the surviv- 
ability of strategic forces. Uncertainty involving the 
complete success of a missile attack on either the attack- 
er's or defender's side acts as a powerful deterrent since a 
first strike represents an unprecedented gamble. Intel- 
ligence information is rarely complete and when decision 
makers confront the uncertainty of a launch during a confer- 
ence, they must weigh the logical consequences of such an 
act and decide on a response to it. This deliberation 
continues to erode the time remaining before our missiles 
must be launched (or lost). 

In deploying offensive forces for the purpose of deter- 


ring war, the dominant peacetime objective is that of 
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preventing accidental or unauthorized use of weapons. 
Preventing errors of this type requires maintaining negative 
control. Negative control means that a variety of physical 
constraints and organizational procedures make it highly 
unlikely for any one individual to fire any nuclear weapons. 
It is equally improbable that the necessary combination of 
people required to fire these weapons, in the absence of 
proper authority, could be organized. 

If war actually were to break out, the dominant objec- 
tive changes to the execution of retaliatory attacks. It 
then becomes important to minimize failures to launch 
weapons against preassigned targets. Preventing errors of 
this type requires positive control: the smooth operation 
and precise timing required to launch missiles. Negative 
and positive control inherently conflict; enhancing one 
diminishes the other to an extent determined by the details 
of the command arrangements for particular weapon systems 
[Ref. 9: p. 38]. 

The issue of positive and negative control brings up 
additional uncertainty, in the form of proper timing of a 
launch. The decentralization problem made by the great 
destructiveness of nuclear weapons emphasizes the conflict 
between positive and negative control. A single location, 
or even a few locations, can not control a modern strategic 
arsenal since these locations may be identified by the enemy 
and pre-emptively destroyed. Thus, many military officers 
at numerous locations (some mobile) maintain the physical 
ability to fire nuclear weapons, although authorization must 
be given and elaborate procedures followed. Since the 
Soviets have reputed to do the same, more uncertainty 
involving many more people with access to nuclear weapons 
comes into play. 

The response of the attacked nation is yet another 


uncertainty. It is impossible to predict in advance how the 
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politicians will act in the face of an actual attack. Arms 
control treaties enhance the uncertainty in intelligence and 
decision making when a possible launch arrives in the data 
gathering system, Since a treaty is designed to "keep the 
peace." Because a Surprise attack on our forces is practi- 
cally unimaginable in peacetime, human operators may hesi- 
tate and rely on the peacetime checks and balances designed 
to keep our forces from going to war accidentally. The key 
problems here involve our belief that nuclear attack and war 
are unthinkable, dampening our response behavior to launch, 
which requires precise timing. Improving the warning 
sensors and the communication lines may ease the problem, 
but such improvements can not completely solve it. Because 
decades have passed without attack, and since the implica- 
tions of authorizing a nuclear war are unthinkable, the 
President, as well as other senior military personnel in 
Charge of the response, may be unwilling to launch any 
nissiles immediately upon receipt of the news of an 
impending attack. This hesitation in response could seal 
our fate. The longer the assessment and conferencing proce- 
dures take, the more opportunity the first striker has to 
attack again and further disrupt the reactions of the 
victim. The victim would have to meet the attacker's first 
strike with carefully planned strikes against the attacking 
nation's sensor and warning systems, as well as against 
nilitary forces, in order to disrupt the attacker's ability 
to engage in additional strikes. The victim must launch a 
retaliatory attack during, or soon after, the first strike. 

Unavoidable false alarms from the data gathering system, 
or from human error, contribute to the slowing of the deci- 
sion process, since it takes longer to confirm an alarm as 
false. While the complexity of the system does make us 
safer from accidental nuclear war, it only protects us 


against isolated failures. Multiple errors or malfunctions 
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invoke confusion in humans that leads to a longer resolution 
time of the alarm. Since the problem with compound errors, 
especially human ones, also increases the number of possible 
outcomes, no system can protect against all combinations. 
The likelihood that multiple events lead to trouble in- 
creases as the activity around a possible threat increases. 
Thus, the complexity of the warning system may amplify 


mistakes when forces are placed on alert. 


C. DECISION SODEL FORMULATION 


Let us assume that the Soviets have the ability to 
launch successfully a coordinated attack. Such an attack 
reguires proper timing in order to minimize interference 
between exploding warheads in the same general area [Ref. 9: 
Domes els 

Again, we use a simple time line to model the decision- 
Making process. We illustrate the decision process by 
including three examples: (1) an ICBM scenario, (2) an SLBM 
scenario, and (3) a test shot scenario. We assume that the 
time of flight of a missile is independent of decision- 
making time. Also, we assume that the decision process 
presented in Section A of this chapter pertains here. 

Again, we assume the timely detection of launched 
missiles. Timely detection and analysis by the sensors 
allows more time for the evaluation and decision-making 
process and for response to the threat as discussed in 
Chapter III. Also, we assume uninterrupted communications 
over the entire systen. 

The Decision Model time line includes the incorporation 
of the different conferences, and the minimum time to reso- 
lution is the minimum amount of time in which the decision 
makers must decide to launch or not launch a counter-strike. 


Recall that, in any scenario, the way NORAD handles a 
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situation remains the same. The same scenarios presented in 


Chapter III are now re-visited below: 
le he Generic Model 
This scenario describes a generic launch: 


tame of flight la 7177. ---|---|---j---] 
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Figure 4.1 The Generic Decision Model 


where LO time of launch 


T1 = first detection 


T2 = system evaluation of launch (threat/no 
threat) 

T3 = missile display conference called 

T4 = second detection 

T5 = threat assessment conference called 

T6 = assessment of launch by decision makers 


(threat/no threat) 
T7 = missile attack conference called 


T8 = last possible time to decide on the type 


of response (launch/no launch) 
T9 = time of impact 


Thus, the minimum time to resolution is (T8-T4). 

The suggested times in the following scenarios indi- 
cate reasonable times to impact for the purposes of discus- 
sion [Ref. 9: p. 39]. 
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a. ICBM Scenario 


This scenario describes an ICBM launch: 
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Figure 4.2 An ICBM Scenario 
The definitions of TO through T9 remain the same and the 
Minimum time to resolution is (T8-T4) = 22 minutes. 
b. SLBM Scenario 


This scenario describes an SLBM launch: 
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Figure 4.3 Àn SLBM Scenario 


The definitions of TO through T9 remain the same. Thus, the 


ninimum time to resolution is (T8-T4) - 4 minutes. 
C. Test Shot Scenario 


This scenario demonstrates how a test shot 
affects the decision-making process as shown in Figure 4.4 
below. In this example, the minimum time to resolution is 
(T8-T4) = 4 minutes. Even if intelligence reports a test 
shot, the conferencing procedure continues as if it is an 
unknown threat. At T4, the data gathering system evaluates 
ho threat based on the projected point of impact (usually 


the ocean). Then, the decision makers realize it is a test 
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Figure 4.4 A Test Shot Scenario 


Shot, and CINC NORAD will not call a threat assessment 
conference. In this example, T5, T6, T7, and T8 may never 
occur; however the launch will continue to be monitored to 
gather as much intelligence data as possible. 

In the case of a launch indicator lacking dual 
phenomenology, at T4, the decision makers assess the situ” 
ation and state whether they have high or low confidence in 
what the data gathering system tells them. As before, the 
process continues until full confirmation is made or the 
sensors stop picking up the launch indicator. 

In the Decision Model, human intervention lays 
a key role which can not be over-emphasized. Human inter- 
vention is both a positive and a negative aspect; positive 
because more minds influence the decision-making process and 
because a launch in retaliation is not automatic but 
requires human intervention to activate the launch mecha- 
nisms. The negative aspects include the increased time it 
takes for a decision to be made by a team of decision 
makers. Moreover, these decision makers are only human and, 


therefore, prone to error. 


D. SENSITIVITY ANALYSIS 


Since the Decision Model is an extension of the Data 
Gathering Model, we will transfer the ideas from the sensi- 
tivity analysis of the Data Gathering Model to the sensi- 
tivity analysis of the Decision Model. In Figure 4.5 below, 


the corresponding points of the two models are shown: 
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The Data Gathering Model 
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The Decision Model 
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Figure 4.5 Corresponding Points of the Two Models 


From our analysis of the Data Sathering Model, we 
observed that the time segments of the Decision Model are 
not as precise as shown in Section C of this chapter. These 
segments also overlap and one event may occur before 
another. We discuss this overlap problem in the examples 


below. 


i 


E 


e ICBI Ihrea 


The events TO, T1, and T2 (which correspond to t0, 
tl, and t2 in the Data Gathering Model) take the same amount 
of time as described in Section F of Chapter III. However, 
the missile display conference T3 can not be called until T2 
- t2 occurs. At the point T3, the duty officers of all the 
command posts confer to decide if the threat is real or 
false. If no conflicting information arises, and the deci- 
Sion makers readily agree, this decision-making process, 
which includes confirmation from the ground site, will take 
about 2 minutes. Figure 4.6 displays the time span and will 
be explained below. Note the independent overlap of TU with 
T5; T6 Ans 
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Figure 4.6 Decision Model Time Line for an ICBM Scenario 


During this ccnferencing procedure, the data gath- 
ering system continues to monitor the launch phenomenon. As 
Stated previously in the Data Gathering Model, the time to 
obtain a second detection at T4 (dual phenomenology) could 
take anywhere from 3 to 7 minutes, depending on the 
missile's trajectory. (Here, T4 corresponds to t3 in the 
Data Gathering Model.) This means that the minimum time 
(shortest interval) to T4 is still about 5.5 minutes and the 
maxinum time (longest interval) is about 9.5 minutes, but 
the missile display conference T3 will occur prior to the 
second detection T4. Even if dual phenomenology does not 
occur after T3, CINC NORAD will call a threat assessment 
conference at T5. If T4 = 5.5 minutes, then CINC NORAD will 
have high confidence before going on to T5, and the threat 
assessment conference will probably last about one minute. 
However, if T4 = 9.5 minutes (or longer), this will not be 
the case. The decision makers will probably want more time 
to assess the situation, hoping to obtain dual phenomenology 
before going on to the missile attack conference at T7. By 
T6, however, the decision makers will have made their 
assessment (with or without dual phenomenology). Then, CINC 
NORAD will call the missile attack conference, reporting 
either high or low confidence in the assessment to the 
President. 

In the minimum (shortest interval) case, with 
T4 = 5.5 minutes, if the missile display conference and the 


threat assessment conference take 1 minute each (overlapping 
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with T4), (T7-T6) = 30 seconds, and if the missile attack 
conference takes about 1 minute, then the President would 
have (T8-T7) = 20.5 minutes to decide on his response and 
23.5 minutes to impact at T9. However, if any of the 
conferences (T3, T5, T7T7) take longer than above, the time 
between T7 and T8 will be shortened, leaving less time for 
the President to make his decision. 

In the maximum case, without waiting for dual pheno- 
nenology, the President would still have 20.5 minutes to 
decide on his response, but he would be working with a low 
confidence assessment. Any President is likely to be reluc- 
tant in giving an order to retaliate without high confi- 
dence. Thus, if T4 = 9.5 minutes and CINC NORAD waits for 
dual phenomenology (although T5, T6, and 17 would still 
occur while waiting), then the President would have (T8-T7) 
= 17.5 minutes. If the interval between T8 and T9 is actu- 
ally 6 minutes (as proposed in Section F of Chapter III), 
this would allow the President 17.5 minutes in the minimum 
case and 13.5 minutes in the maximum case. The question of 
walting for dual phenomenology, therefore, becomes an inpor- 
tant one. We discuss the implications of various launch 


policies which bear on this issue in Chapter V. 


2. The SLBM Threat 


The time intervals up to and including T6 remain the 
sane here as in the ICBM scenario. But the situation 
becomes more stressfui with the shorter time of flight for 
an SLBM with the addition of conferences. Again, the situ- 
ation regarding depressed, lofted, and minimum energy 
trajectories of SLBMs applies here. The requirement for 
dual phenomenology increases the tine between T2 and T4 
(corresponding to t2 and t3 in the Data Gathering Model) 
when the SLBM is ina depressed trajectory. The same result 


occurs 1f a submarine launches its SLBMs close to the coast 
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as described in Chapter III. Figure 4.7 shows the time span 
for an SLBM threat: 


HS لے ]إو ار‎ [ 
Steht ۱ b 2! l 5 L } 615 7 minutes 


launch impact 


Figure 4.7 Decision Model Time Line for an SLBM Scenario 


The Minimum time to T4 is 5.5 minutes. This time 
permits only 3.5 minutes total decision-making time before a 
response is required from the President and only 6.5 minutes 
before impact of the missile. If the maximum time is 
(T4-T0) = 9.5 minutes, then no decision-making time exists, 
and only 2.5 minutes remain to impact. AS we mentioned 
earlier, T4 overlaps T5 (T3 has already occurred). The 
events T6, T7, and T8 can occur prior to T4 if the President 
is willing to make a decision with a low confidence assess- 
ment. However, if he requires dual phenomenology, T8 can 
not occur until T4 occurs, thus, shortening the final 
decision-making time. Any President with peaceful inten- 
tions will wait until T4 occurs before giving an order to 
retaliate. In the minimum case, the President has (T8-T7) - 
2.5 minutes to make his response. In the maximum case, the 
President has no time left. 

With 6 minutes vice 3 minutes as the minimum time to 
perform a launch sequence, that is, (T9-T8) = 6 minutes, the 
President would have no time to think if (T4-T0) = 9.5 
Minutes and dual phenomenology is required. In any case, 
the conferences will have to be rushed (perhaps only 30 
seconds apiece), if any assessment is to be given to the 
President in time to launch a retaliatory strike (if that is 
the President's chosen response.) Because of this extremely 
shortened time interval, the President may be forced to make 
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a decision with a low confidence assessment from CINC NORAD, 
if dual phenomenology does not occur within 9 minutes after 
a launch of an SLBM attack. 
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V. THE PROBABILITY OF ACCIDENTAL NUCLEAR WAR 


A. INTRODUCTION 


In this chapter, we combine the Data Gathering Model and 
the Decision Model to show the implications of policies such 
warning systen. We first describe the segment of the time 
line that affects the decision to use one of these policies. 
We assume the United States is operating under peacetine 
conditions in this discussion. Tha time lines in Figure 5.1 
represent the intervals of time during which launch policies 


affect future decisions: 


The Data Gathering Modei 


time of flight -—-|---|]---4|---]|]---]---]|---1|--- 
S tô t1 d e t4 È 
launch 
The Decision Model 
time of flight ---|---|---|---|---|---|---j--- 
a 1 T1 T 1 T4 T T6 I T 
launch 
Figure 5.1 Affective Segment of the Time Line 


The affective time lines do not include impact since after 
T8 (t5), no time remains to launch effectively a retaliatory 
strike. Also, recall that a false alarm occurs if (1) a 
launch detection occurs; (2) the data gathering systen 
labels it a threat by T2 when no threat exists; and (3) a 
threat assessment conference is called at 15 before confir- 
mation of the threat. 
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The following data comes from NORAD (Ref. 10] and shows 
the nunber of conferences called fron 1977-1983, including 


the false alarms discussed earlier in Chapter II: 


TABLE II 
Emergency Action Conferences by Year 
L 


TEAR BOUTEY RiNILS COMER CALLED, cma. 
CONFERENCES POSSIBLE THREATS CONFERENCES 
1977 1567 43 0 
1978 1009 70 2 
1279 1544 78 2 
1980 3815 149 2 
1981 28 9 186 0 
1982 3716 218 0 
1983 329 4 255 0 


The routine missile display conferences do not fit any 
of the previous definitions we used and, therefore, will not 
be considered in this analysis. Note the number of confer- 
ences called to evaluate possible threats (these are the 
missile display conferences, as we defined them earlier). 
The numbers appear to increase as the years progress. 
However, we explained the cause of this behavior in Chapter 
II. The false alarms that occurred in 1978, 1979, and 1980 
resulted in the threat assessment conferences that were 
called. However, in those cases, confirmation of the threat 
was not made: in each case, the response from the site 
indicated that a threat did not exist. In fact, the site 


had absolutely no indication of a launch on their display. 
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The procedures followed in those years differ from the way 
CINC NORAD currently calls threat assessment conferences. 
Today, if no confirmation comes from the site, CINC NORAD 
probably will stop the conferencing process at that point to 
determine if there is a failure at NCMC. Thus, a threat 
assessment conference may not be called. If the site 
reports launch and impact points in close agreement with 
NORAD's inconing data, this confirmation gives at least a 
low confidence assessment, and CINC NORAD will continue the 
conferencing procedure by calling a threat assessment 
conference. Nevertheless, in the analysis of the next two 
sections, we use the above table as if the threat assessment 
conferencing situations are the same (as described in 
Chapter IV). 


B. POLICY TYPES AND DISCUSSION 


Ve begin this discussion with the launch-on-warning 
case, because of its sinplicity. The United States does not 
currently have such a policy; however, there are many advo- 
cates of launch-on-warning, since this policy improves reac- 


1. —Daunmen-Ün-Warndnq 


Launch-on-warning means that upon detecting the 
launch of an enemy's missiles and confirming the threat at 
the site (albeit with low confidence), we would launch sone 
fraction of the threatened ICBM force before those missiles 
reached any of their targets. 

This extremely broad definition contains several 
inportant implications. For instance, to carry out a 
launch-on-warning policy in the event of an actual enemy 
nissile launch, the decision makers must declare the threat 


confirmed; that is, the data gathering system and the 
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decision makers both must agree that the situation is a 
confirmed threat situation. Then, CINC NORAD reports low 
confidence in the assessment to the President. A launch-on- 
warning stance presumably allows more time for the bomber 
forces to escape and increases the amount of time to execute 
a counter-strike. The SLBM scenario, described in Chapter 
IV, makes the importance of these two features extremely 
apparent. 

Using the table from Section A, we can now ask the 
question, "How often does a false alarm occur in the case of 
a single system failure?" Recall that threat assessment 
conferences were called in the situations where a false 
launch indication occurred; 6 times over 6 years. Thus, the 
average arrival rate 1s one per year (for a single detection 
with lcw confidence). 

Adopting a launch-on-warning policy in peacetime 
implies that if a single failure occurs in the system, and 
the site confirms the threat, then the following sequence of 
events may take place: 


time of flight ]|7--7--|99-|-—--- nl 
T T1 T TI TS To. TJ 


launch shoot! 


Figure 5.2 Launch-On-Warning Time Line 


Note the change to the Decision Model--the decision maker 
does not wait for TU (second detection from a different 
family of sensors) to occur before giving an assessment to 
the President. The President also does not necessarily wait 
for a second detecticn to give a launch order. 

Thus, a lower bound for the expected waiting time 
until an accidental nuclear war is 1 year, if the President 
chooses to retaliate under the conditions just described. 


What makes this a lower bound is the fact that a false alarn 
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must persist long enough without dual phenomenology to 
convince the President to act with only a low confidence 
assessment. 

In any case, launch-on-warning is a high risk 
policy, especially when great international tensions exist 
between the United States and the USSR, as they do today. 

In peacetime, a Single failure without dual phenomenology 
puts the President in the extremely difficult position of 
deciding how long to wait before giving an order to launch a 
counter-strike. 


The presence of dual phenomenology (the confirmation 
of a launch by two families of sensors) gives much nore 
reliability to a confirmed threat. In previous chapters, we 
demonstrated how much the decision makers rely on dual 
phenomenology to reduce the chance of an incorrect response. 
We now discuss how much better the warning system actually 
becones. 

Currently, the United States has a launch-under- 


attack policy. In this thesis, Jaunch-under-attack means 
launching some fraction of the threatened ICBM force when 
the early warning system confirms a threat and that threat 
is assessed with high confidence. Again, the data gathering 
system and the decision makers must agree in their assess- 
nent that the threat is confirmed, as in launch-on-warning. 
The conditions of dual phenomenology and a predicted impact 
point in friendly territory define the confirmed threat. 
The difference in this policy arises from CINC NORAD's 
assessment to the President: here, CINC NORAD reports high 
confidence in what the sensors reveal, since dual phenome- 
nology is required. The President is still the responsible 
authority for the initiation of the launch: whether it is 


one missile or many missiles, the decision to implement a 
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launch-under-attack rests with the President. An advantage 
to this policy is that a launch-under-attack lessens the 
probability of accidental nuclear war while maintaining a 
strong deterrence. 

If the United States continues to follow a launch- 
under-attack policy, what sequence of events must occur to 
Cause an accidental nuclear war? Since under launch-under- 
attack, the United States would not launch a retaliatory 
strike if only one system failed, a necessary condition for 
accidental nuclear war, in this case, is for two different 
false alarms on two different sensors to occur. Plus, the 
false alarm on one system must overlap the false alarm on 
the other system. Moreover, the two systems must agree 
approximately on the launch and impact points, so that the 
decision maker sees the same launch phenomenon on two sepa- 
rate systems. Ihe overlap time must also be of sufficient 
duration to allow enough time to launch a counter-strike. 
In Chapter IV, we assumed three minutes (initially) to carry 


out the launch order. 


first false alarn 
I 


radar 
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system #§§e------ | -+- | ------------- 
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second false alarn 


Figure 5.3 The Interval Overlap 
The minimum overlap time, then, is defined as the intersec- 
tion of two false alarm intervals for at least 3 minutes. 


In Figure 5.3 above, we assume that the time intervals are 


Stochastically independent, and so are the false alarms in 
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the two systems. If we assume that the arrival process of 
the false alarms is a Poisson process, the intervals between 
arrivals are exponentially distributed. 

In order to calculate an upper bound for the prob- 
ability of a double false alarm using dual phenomenology (a 
double false alarm on two different systems), we assume the 


following: 
1. We disregard the difference between the false alarms 
on the two different systems (assumed above), 


2. The combined rate of the radar false alarms and 


infrared false alarms is one false alarm per year, 


3. The time between arrivals of the combined false alarms 


is exponentially distributed. 


If all these false alarms involve ICBM launches 
only, what is the probability that two successive false 
alarms occur within 27 minutes of each other (i. e., a 3 


ninute overlap)? Let 


X = the time between false alarms 


then 


P(X < k minutes) = 1-e 


I 
هشب‎ 
۱ 


(1* (-Ak) + )-(۷( ۰۸/2۲ * . . .) 


where À is one per year (that is, the mean time to wait for 
a false alarm is 6/6, or one year). Dropping all but the 


first three terms gives 


P(X < k minutes) ~ ۷ 
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in minutes. Note that the units for } and k must conform. 
Since we assumed that it takes at least 3 minutes to execute 
a counter-strike launch, at least a 3 minute overlap is 
necessary. This is the "worst case" situation. 

The upper bound (worst case) for an ICBM scenario is 
in the situation where a 3 minute overlap occurs. Here, the 


calculation gives 


P(X < 27 minutes) 277 (365) (24) (60) 


0.000051 


Therefore, a lower bound for the expected waiting time of 
this event is 1/0.000051 which is approximately 19,467 
years. These calculations are very restrictive since we 
have assumed a combined false alarm rate. This assumption 
means that two sensors could fail in the same family. from 
what we have described, we must have false alarms from two 
families of sensors. This makes the probability even lower 
than 0.000051 and the expected waiting time greater than 
19,467 years. 

The upper bound for an SLBM scenario is for a 3 
Minute overlap to occur: 


۱۱ 


P(second false alarm occurs < 9 minutes) 9/(365) (24) (60) 


0.000017 


In this case, the expected waiting time to a double false 
alarm 1S approximately 58,400 years. The upper and lower 
bounds of the ICBM scenario cover this and all other 
Situations. 

In conclusion, the United States will probably never 
accidentally launch a retaliatory strike with a launch- 
under-attack policy, if the false alarm rate remains the 


same as in Table II. The graph in Figure 5.4 shows how the 
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expected waiting time varies with different lambdas. 
However, Adding sabotage and nuclear proliferation raises 
the probability and decreases the expected waiting time. 
Nevertheless, with these probabilities as upper bounds, a 
decision maker will pause and take time to analyze false 
alarms under these conditions. 
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Figure 5.4 Expected Waiting Time Versus Lambda 


These same calculations assist the decision maker in 
determining whether an alarm is real or false by adding the 
conferencing procedure. If the decision maker decides the 
first alarm is false, then when a second alarm occurs, it 
merely supports the fact that a system failure has occurred. 
Also, including the conferencing procedure may add more time 
to the process, allowing for the possibility of the alarm 


being confirmed by dual phenomenology, or evaluated as no 
threat. 


69 


This addition of time to the decision-making process 
could be a blessing in disguise. If the system gives a 10 
Minute impact time, but the decision-making process already 
has taken 15 minutes, then probably no launch has occurred. 
Thus, if no impact materializes by the 10 minute limit, and 
the decision makers still have not reached a decision, the 


conferencing procedure, again, will probably stop. 


C. | SUMMARY 


Sophisticated systems to warn of nuclear attack are 
necessary for the protection of the United States. Also, if 
the Soviets know that the United States has an effective 
warning system, they are less likely to initiate an attack. 
Since both the United States and the USSR possess effective 
warning systems, both sides have less incentive to launch an 
attack, and the world is more stable as a result. 

The Missile Attack Warning System is designed to make 
sure that the decision to go to war is not driven by a flock 
of geese or a defective computer chip. A human is always in 
the decision loop. 

Although the launch-on-warning policy would improve 
reaction time in performing a counter-strike launch, it 
seriously impairs rational decision making in a time of 
extreme stress. A launch-on-warning policy puts the 
President in the "hot" seat nearly once per year. But such 
a burden, even once every 4-year term, would be enough for 
any President. The risk of accidental nuclear war under 
launch-on-warning is great enough to make this policy very 
unattractive. 

Launch-under-attack, on the other hand, is much safer, 
given its requirement for dual phenomenology. The condi- 
tions necessary for a double false alarm (a false alarm in 


two separate systems) to occur in a time overlap of at least 
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3 minutes make the probability of accidental nuclear war 
extremely small. The President must still undergo immense 
pressure, but he can be virtually assured of making the 


correct response decision. 
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APPENDIX A 


ACRONYMS AND ABBREVIATIONS 


Aerospace Defense Command 
Alternate National Military Command Center 
Ballistic Missile Early Warning Systen 


Conmander-in-Chief, North American 


Aerospace Defense Command 
Commander-in-Chief, Strategic Air Command 
Distant Early Warning Line 
Electromagnetic Pulse 

Intercontinental Ballistic Missile 

Joint Chiefs of Staff 


Multiple Independently Targeted Re-entry 


Vehicle 
National Command Authority 


North American Aerospace Defense Command 


Cheyenne Mountain Complex 
National Military Command Center 
North American Aerospace Defense Command 


Perimeter Acquisition Radar Attack 


Characterization System 
Strategic Air Command 


Satellite Early Warning Systen 


dz 


SLBM Submarine-Launched Ballistic Missile 


SOSUS Sound Surveillance System 
SPASUR United States Navy Space Surveillance Network 
SRF (Soviet) Strategic Rocket Forces 
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